In a packet-switched communication network, transmitted data is grouped into suitably sized blocks called packets. Packets carry both a payload data and a destination data. The network equipment routes each packet individually, based on the packet's destination data, and allocates transmission resources as needed.
Due to the packets being routed individually, and due to a large number of users in a typical packet-switched network, the bandwidth utilization at a particular physical port of the network can vary widely. Control mechanisms have been implemented to monitor data traffic and troubleshoot congested or malfunctioning locations or nodes of packet-switched networks.
One approach to troubleshooting a packet-switched network is to copy the entire network traffic at a faulty network node to a storage disk array, and then analyze the accumulated data to find a fault. This approach can be costly and inefficient in that the faulty network node location is generally not known in advance, so that the storage systems and the analyzing equipment need to be installed throughout the network for this approach to work. At tens of gigabits per second data speeds, very large data storage capacities are required at multiple nodes. Furthermore, a problem may not be associated with a single network node, and thus not easily identifiable by performing analysis at individual nodes.
Another, more cost-efficient approach is to install local monitors throughput the network. The local network monitors analyze individual multimedia streams, searching for data patterns associated with a particular network problem. Suspicious or faulty data packets including these target data patterns are duplicated and forwarded to a centralized location, where they can be analyzed.
Oran in U.S. Pat. No. 8,023,419 discloses a switched packet network monitoring system having a packet filter installed on one or more interfaces of a router, switch or other node in an IP network that identifies multimedia packets for a particular media stream. A packet replicator duplicates the identified packets, allowing the original packets to continue through the IP network. A forwarder encapsulates and sends the cloned media packets to a central facility, where the “tunneled” media stream can be analyzed. To preserve the bandwidth, the payloads of these “tunneled” packets may be dropped, or the headers may be compressed. Disadvantageously, dropped payloads can result in a loss of valuable diagnostic information.